BUG##849717: Crash in Item_func::fix_fields on second execution of a prepared statement with semijoin

- If convert_join_subqueries_to_semijoins() decides to wrap Item_in_subselect in Item_in_optimizer, 
  it should do so in prep_on_expr/prep_where, too, as long as they are present.
  There seems to be two possibilities of how we arrive in this function:
  - prep_on_expr/prep_where==NULL, and will be set later by simplify_joins()
  - prep_on_expr/prep_where!=NULL, and it is a copy_and_or_structure()-made copy of on_expr/where.
  the latter can happen for some (but not all!) nested joins. This bug was that we didn't handle this case.

1 files changed, 13 insertions, 0 deletions

diff --git a/mysql-test/t/subselect_sj.test b/mysql-test/t/subselect_sj.test
index bac42fc684e..cc9518d9de7 100644
--- a/mysql-test/t/subselect_sj.test
+++ b/mysql-test/t/subselect_sj.test
@@ -1722,5 +1722,18 @@ drop table t1,t2, t3;
 set optimizer_switch=@tmp_830993;
 set join_buffer_size= @tmp_830993_jbs;
 
+--echo #
+--echo # BUG##849717: Crash in Item_func::fix_fields on second execution of a prepared statement with semijoin
+--echo #
+CREATE TABLE t1 (a int);
+CREATE TABLE t2 (a int);
+CREATE TABLE t3 (a int, b int) ;
+
+PREPARE st1 FROM "SELECT * FROM t2 LEFT JOIN t1 ON t2.a != 0 AND ('j','r') IN ( SELECT b,a FROM t3)";
+EXECUTE st1;
+EXECUTE st1;
+
+DROP TABLE t1, t2, t3;
+
 # The following command must be the last one the file 
 set optimizer_switch=@subselect_sj_tmp;